Posted
by
samzenpus
on Monday February 16, 2015 @04:14PM
from the protect-ya-neck dept.

Advocatus Diaboli writes The money and time required to develop the Equation Group malware, the technological breakthroughs the operation accomplished, and the interdictions performed against targets leave little doubt that the operation was sponsored by a nation-state with nearly unlimited resources to dedicate to the project. The countries that were and weren't targeted, the ties to Stuxnet and Flame, and the Grok artifact found inside the Equation Group keylogger strongly support the theory the NSA or a related US agency is the responsible party, but so far Kaspersky has declined to name a culprit. NSA officials didn't respond to an e-mail seeking comment for this story. What is safe to say is that the unearthing of the Equation Group is a seminal finding in the fields of computer and national security, as important, or possibly more so, than the revelations about Stuxnet.

This is the video that might explain the attitude: it's Spielberg vs. Hitchcock in an epic rap battle:
https://www.youtube.com/watch?... [youtube.com]
Whatever your opinion of the directors, you might find the video hilarious!

I had never seen this acronym before but when I seen it I automatically read it as If You Know What I Mean And I Think You Do. I am shutting down my computer now and taking a break from this internet thing.

Wow, I found an Affiliated Associations of America. If the following isn't the biggest piece of business jargon that doesn't say anything, I don't know what is.

Welcome to the AAOA benefits website. Through a cooperative platform, we developed a benefit program to enhance the value of membership for your Membership Organization or Association. AAOA provides a turnkey member benefit solution that offers companies and their employees an opportunity to reduce the costs of doing business. Take advantage of our group purchasing power and receive full access to exclusive member discounts and pricing. Look around the site and let us know if you have any questions or would like to discuss membership. With AAOA, membership doesn't cost, it pays!

It's just super meta. It sounds like they're a group that helps people start associations, and then connects them to each other, associating their associations and maybe letting them group-purchase tools to manage their memberships or something?

Suppose you're a grocery and you would like to implement a membership card. Now you have to deal with lost cards, signups, people wanting to know how many loyality points they have, decide how many points to give for which purchase, what to give as a reward for points spent, etc. etc.

This type of company takes it all out of your hands, provides a pre-packaged membership club with set rewards, tiers, perks, whatever, and puts your brandname on top of the website, the loyalty card, and the brochures. The grocery probably pays a price per customer that's lower than when they would run it themselves, and the affiliate organisation has scale, so can run things cheaper while providing better service than a single company can do.

The whole thing is just hype. Enormous time and money? Deployment aside, I could DEVELOP something like this BY MYSELF. Virtual file systems? I wrote one on Fuse on a whim, to intercept disk access calls and check against policy. Exploiting a kernel driver? Same as exploiting anything else; it's a zero-day malware. Hundreds of CNC servers? Vanilla botnet--a deployment issue. Detecting iPhones and doing weird shit? Yeah, I work in DevOps; I have a server that detects mobile phones and redirects th

However government agencies using inside knowledge of source code to create these attack tools and then being stupid enough to use them ie release them into the wild where organised crime can get hold of them, is not so new. It fact it is totally and utterly mind bogglingly stupid thing to do, how fucking myopically short sighted can those fuckwits be. Government need to bloody wake up to what is going on and create a huge level of separation between attack and defence elements of cyber security. In fact t

I'm not sure how I see that this is a good thing. I know it's fun to hate on the intelligence community (I've done it too), especially when we feel like our own rights have been infringed, but are we really saying that we are in favor of anything which hampers the West's ability to take clandestine actions against other states? After all the complaining we do about Congress and all the bureaucracy that comes along with anything usually related to government, we are then saying that absolutely every hostile action should be subject to the same oversight that produces exactly that molasses-like barrier to actual results?

It is without question that, at times, the intelligence community must have overstepped its bounds, as any entity with that much power would on occasion. Maybe in their case that happens far more often than it should. But does that really mean they should have no real power at all?

So everyone should just leave their doors wide open so the cops never have to break a door down to nab a crook? Yeah, right. If the NSA can hack into our computers, the bad guys can too. The best way to improve cybersecurity is to fix all the exploitable holes they've been using. But instead of helping us to secure our systems they've left them vulnerable because they're too lazy to pound the pavement, get individual warrants and plant bugs. Having every computer system in the world remain vulnerable made their job easier, so they chose that route, which also made the bad guys efforts easier too. But hey, it's job security, eh?

How do you know they don't have a warrant? It seems like using md5 and sha1 hashes to ensure they are only targeting specific individuals smells like somebody with very specific instructions and stiff repercussions. Otherwise it would be easier to grab a pile of people and sort them out later.

No, quite the opposite. At the same time, though, what would happen if every soldier's gun had a chip that required "command approval" before any member of a squad could start firing? Sure, individual soldiers kill the wrong people, and for the wrong reasons, all the time. Hopefully, though, most of the time it is for the right reasons. And regardless, to place such restrictions on them limits their ability to safely carry out their intended purpose to such a degree that it is a problem.

They are the intelligence community, not our national cybersecurity consulting firm, and they only ought to be notifying the public if the risk to national security involved in leaving the vulnerability open is greater than the risk to national security involved in losing the intelligence that could be gained from it.

What you're saying is we HAVE NO national cybersecurity entity whose purpose is to protect our infrastructure from bad actors using exactly the kinds of methods and exploits we're seeing here. And given that, we have to rely on Kaspersky to do it for us. Not only is it then a good thing, it's long overdue.

Essentially an argument that back-doors do more good than harm: 'Cold fjord', is that you?

Like a politician, you're saying your policy solves the problems we cause. What about the harm caused by a back-door? You haven't answered the basic question about back-doors: Can China use all those back-doors too? Because back-doors are good, then China gaining intelligence must be good too. By the way, your answer doesn't count, only China's.

I wasn't arguing that everyone should be happy about this. I would imagine that, if China found out about something like this, they would be quite upset. Similarly to how upset they would be when they found a spy in their government. That doesn't mean that our intelligence community shouldn't be trying to do exactly that and, presumably, vice versa (and, I would imagine, each is both trying and succeeding).

To address your other point: I think that, if there is evidence that industrial espionage against t

"what would happen if every soldier's gun had a chip that required "command approval" before any member of a squad could start firing? Sure, individual soldiers kill the wrong people, and for the wrong reasons, all the time. Hopefully, though, most of the time it is for the right reasons. "

What would happen if every computerized autonomous weapon system had a chip that required "command approval" before firing?

There's no such a chip on soldiers' weapons for a twofold reason:* There's not enough man/computer

I think the intelligence community has done more harm than good more often than not.

I think American foreign policy has done more harm than good to America more often than not.

For example, look at the Iraq war. We destabilized that entire region of the middle east, and left it wide open for ISIS and other militant groups.

We supported the other "color" revolutions which also deposed effective dictators who were finally out of power after we supported them for so long. In every case the hippie revolutionaries were quickly brushed aside and replaced by really tough guys.

Same with Assad in Syria. When he loses control of a region, ISIS moves in. You notice that the U.S. has stopped calling for Assad to leave.

I think you make an argument worth making, but your argument is about the application of tools, not the tools themselves. If the military and/or intelligence communities are being told to achieve objectives (or are even internally setting objectives) that do more harm than good, then they should be redirected. Even so, just like the military shouldn't lose their guns or cops shouldn't lose the ability to arrest people if they are arresting the wrong people, the intelligence community should not lose the too

I think the intelligence community has done more harm than good more often than not.

I think American foreign policy has done more harm than good to America more often than not.

Throughout history, it has been the use of power which has undermined empires, and the threat of the use of power which makes them most effective. Wars are costly and can be unpredictable; they have almost always much more expensive than planned and almost always much less useful, except at certain very defined tasks. (Giving someone a temporary boost to poll numbers, uniting a country against a perceived threat, acting as a salve to respond to demand for war that leaders are afraid to turn down).

What our intelligence services are doing is overthrowing brutal, efficient dictators who kept their country together and replacing them with brutal, inefficient armed gangs who are tearing their country apart.

Saddam Hussain had one of the best education systems, and one of the best health care systems, in the mideast. They had a higher ratio of female college professors than we do in the US.

Confirmation bias. When intelligence succeeds, you never hear about it. ULTRA, probably the most successful intelligence operation ever, was kept secret for decades. Nobody knew what it was or how it had helped.

You need to watch it talking about the color revolutions that way. Sounds like dog whistle racism to me. Just because Obama did it doesn't mean it was wrong. Nobody could have predicted this outcome.

The term "color revolution" has nothing to do with race. It refers to movements like the Orange Revolution in the Ukraine, the Rose Revolution in Georgia, the Purple Revolution in Iraq, the Cedar Revolution in Lebanon (not a color but it fits in the category), and the other revolutions of the Arab Spring.

What they have in common is that most of them, like the Orange Revolution, got money, strategic advice, and other support from the U.S., through the International Republican Institute and the National Democ

It's a good thing because I appreciate knowing what kind of country I really live in. For most of my life I thought I lived in a country that wouldn't torture people. Later I learned that the CIA not only tortures people, they ship people to other countries so they can be tortured harder. That's one of many examples of the things they don't teach you in school that should nonetheless influence how you think and vote. I want to know the ugly truth about what's going on. It probably won't make me happy,

Actually, I should modify my comment. The headline does say a different thing from the summary, but the actual article does in fact go on to give some reasonable evidence that connecting the group to the NSA. So, "tied to NSA" is an accurate summary, although with the caveat "tied to" is words that "stop short" of saying that it actually is the NSA.

The headline that they are "tied to NSA"... but TFA says that "researchers stopped short of saying Equation Group was the handiwork of the NSA."

In fairness, by 'stopped short' they mean that the Kaspersky guys essentially said, 'We're not saying it's the NSA - we just can't imagine anyone else on the face of the earth who has the resources necessary to do this kind of thing.' So yes, the report was released with a nod in the direction of the NSA.

RTFA. They point out that they don't have an example of actual Mac infections (they only have two for Windows over the last 15 years), but that they get regular communication from infected machines identifying as Mac OS. Kaspersky makes it clear that they believe Macs are also compromised as a result. Nothing is mentioned about Linux, but I'd be surprised if they don't have access there as well.

Ya.. another related post from engadget (http://www.engadget.com/2015/02/16/hard-drive-spyware/). "It's been known for a while that the NSA will intercept and bug equipment to spy on its soon-to-be owners, but the intellgency agency's techniques are apparently more clever than first thought. Security researchers at Kaspersky Lab have discovered apparently state-created spyware buried in the firmware of hard drives from big names like Seagate, Toshiba and Western Digital. When present, the code lets snoops collect data and map networks that would otherwise be inaccessible -- all they need to retrieve info is for an unwitting user to insert infected storage (such as a CD or USB drive) into an internet-connected PC. The malware also isn't sitting in regular storage, so you can't easily get rid of it or even detect it."

You can hate the NSA all you want, but I have to tip my cap at their utter genius.

Beyond the technical similarities to the Stuxnet and Flame developers, Equation Group boasted the type of extraordinary engineering skill people have come to expect from a spy organization sponsored by the world's wealthiest nation. One of the Equation Group's malware platforms, for instance, rewrote the hard-drive firmware of infected computersâ"a never-before-seen engineering marvel that worked on 12 drive categories from manufacturers including Western Digital, Maxtor, Samsung, IBM, Micron, Toshiba, and Seagate.

The malicious firmware created a secret storage vault that survived military-grade disk wiping and reformatting, making sensitive data stolen from victims available even after reformatting the drive and reinstalling the operating system. The firmware also provided programming interfaces that other code in Equation Group's sprawling malware library could access. Once a hard drive was compromised, the infection was impossible to detect or remove.

Thank you, National Security Agency, for doing such a truly brilliant job of damaging future prospects for the American computer hardware industry. Smart move to leave the torture to the CIA, no reason for geeks to get their hands dirty. You, along with the CIA, daily provide the rest of the world with evident of how deeply, incredibly stupid supposedly smart people can be when they don't mix with grown-ups. Congratulations!